# ClickFix attacks infecting PCs and Macs are going viral

> **Open Intelligence Dossier** · First detected: 2026-09-12 00:07 UTC · Category: Technology

## Executive Summary
ClickFix malware spreads via fake AI chat installers, hijacking Macs and PCs to steal credentials and crypto wallets

## Intelligence Brief
The campaigns use shared AI chat prompts that masquerade as legitimate Claude or ChatGPT installers, tricking users into running malicious code. Once executed, the payload delivers the MacSync stealer, which is designed to harvest login credentials and cryptocurrency wallet information from macOS devices. Coverage of the wave appears across six outlets. KELA Cyber Threat Intelligence outlines how macOS infostealers target Apple devices, while B2B Cyber Security points to the role of shared AI chats in spreading the malware. cyberpress.org and gbhackers.com detail the use of ClickFix lures to deploy the MacSync stealer and to bypass macOS security mechanisms. cybersecuritynews.com focuses on the fake Claude and ChatGPT installers as infection vectors, and Ars Technica notes the viral nature of the attacks on both PCs and Macs.


The reports place ClickFix within a broader trend of AI‑generated lures that exploit user trust in conversational assistants. MacSync, identified as a credential‑stealing stealer, aligns with recent macOS infostealer activity that seeks to extract sensitive data, including cryptocurrency keys. The ability to bypass built‑in macOS security, as highlighted by gbhackers.com, underscores a growing sophistication in cross‑platform malware that leverages social engineering through popular AI tools. Analysts advise monitoring for additional ClickFix‑related campaigns, especially those that may adopt new AI chat disguises or target other operating systems.


Security firms are likely to issue detection signatures for the MacSync payload, and updates from Apple’s security team may address the bypass techniques described. Observers should watch future coverage from the same outlets for guidance on remediation steps and any emerging variants, and anticipate patches from Apple and advisories from cybersecurity vendors.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| KELA Cyber Threat Intelligence | macOS Infostealers: How Hackers Target Apple Devices | [Source Link](https://news.google.com/rss/articles/CBMiX0FVX3lxTE9pWVNnSlZudVdMLUpxMlpVRmZiX3JIdVdNVkhBS1ZlM1BDak04bU1ISzMzMjJaazhXZXhHbEIwTXJrS3pNLURESVI2MDBrMHdwemd6YnNwLVRoZ2VySUQw?oc=5) |
| B2B Cyber Security | ClickFix: Shared AI chats spread malware | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE92dW1YdmxtVTJkZkxyNjdMZkxWNTVaSFdkXy01aU9OUzFMb1ZUOHk4M0VfTUxPeG9sbEFZRTlsVXZFR1hTUTZySjV0VnZlLTlkc2JEMEswbk1tVDA3ckxSUUt1V25peW9NWlczaFYyaDJpS1dieThUckVDWTdqdw?oc=5) |
| cyberpress.org | MacSync macOS Stealer Exploits ClickFix Lures to Steal Credentials and Cryptocurrency Wallets | [Source Link](https://news.google.com/rss/articles/CBMiY0FVX3lxTE1pdklOQnpNYjBmbDhPbUo4aXItclhTZ3NQNlpHYVQ1UkYxcHlqalhOVGJHOXNZSTdNWms0dGxzSGpBUjBuNDA4TTFyM3NwNk82anItN2pQdU5CazZIcDg5RlBxUdIBY0FVX3lxTE1pdklOQnpNYjBmbDhPbUo4aXItclhTZ3NQNlpHYVQ1UkYxcHlqalhOVGJHOXNZSTdNWms0dGxzSGpBUjBuNDA4TTFyM3NwNk82anItN2pQdU5CazZIcDg5RlBxUQ?oc=5) |
| gbhackers.com | Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security. | [Source Link](https://news.google.com/rss/articles/CBMiX0FVX3lxTE1JZFNkcE1yRXRRT1dZSHZ3X0FBMXFJZmduWXJTdGY3NFZidnpabHc1MjFSa0NCcnRUaF9BeTdjTVRuX0ZGbjJHUjZybmMwQ09MTm51VUdkeHp4eERZU2hN0gFkQVVfeXFMTnlHaDNBMmF2WURpMF9zZ0hvTE5kdzhnckRna3NwMlgwNzI2Vk1iVDJtdE9LS0lxeUlOOWsxaDlyWFJuS1RRUGJuZzhqdHlxcDhoa1VYN1NDLXBoM0drc3BraDZSeg?oc=5) |
| cybersecuritynews.com | Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware | [Source Link](https://news.google.com/rss/articles/CBMic0FVX3lxTE1DUjlCTEUxSEFPUDlkeC1wY3lzWkFVZmtMb19zUjRuMXhyLUozY0tGaXRpWkk2a3MtaHBpcUR4RWVSTTNOUmJRb2trS01MZlQxYjM5YlNPZFY5Z0x3Y2l0Tk5Cb05jcldFRGlMcDFBZlI4aVXSAXhBVV95cUxON2g0alFvXzNPUUVkRU9yTlNubkV4WS1SM0ZKbEZqVThlbHQyZWJaV1N1RG43ZGsxbTgzYnJoUEdvSTlZRVN4X19YazVxSGg0YUxtT3BwbHBTMnltV0dvRndSWXJmNlY2a3poa0lnSXViOGxfRDNncDA?oc=5) |
| Ars Technica | ClickFix attacks infecting PCs and Macs are going viral | [Source Link](https://news.google.com/rss/articles/CBMingFBVV95cUxOV3FuN0NSaUE2VTBqSGU4aWMwMXRwRW1zTC15dGNlYl8taGZlN2NoVXRIZ1Y4bEdWWlZyclg4ZERxdUc5UGN0Sko1a0JQS1k5dURuTV95ZTUyMHNRUGJzLXlYbDN3blFGSmRuelg0enp4NjZ3SF91NDBDcXFYdDNrVE9QZnI2c1N5endsZDlSYlZwcE50TURCUE9ncmhDQQ?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-09-12/clickfix-attacks-infecting-pcs-and-macs-are-going-viral*